’'230l6745ab89efcd"

appendices of BBSIrV^

„ -nyptographic i 1

Sn!^,®XamPle ' to read

the
NBSIR 80-2019

Technical Specifications of a

Proposed Federal Information

Processing Standard on the

Modes of Operation for the

Data Encryption Standard

MICHAEL J. O’BRIEN

Institute for Computer Sciences and Technology

National Bureau of Standards

Washington, D.C. 20234

Issued April 1 980

KATlQtfAI. BXJKEAXJ or BTiurotRC*

Liiuuurr

NOV 2 4 1980

fl&L CLCC--

QClob

. USb

'bo I q

IQ $o

U.S. Department of Commerce

Philip M. Klutznick, Secretary

Luther H. Hodges, Jr., Deputy Secretary

Jordan J. Baruch, Assistant Secretary for Productivity, Technology, and Innovation

National Bureau of Standards

Ernest Ambler, Director
C§£< t 9 ¥*9*
TABLE OF CONTENTS

Page

1. PREFACE 1

2. INTRODUCTION 3

3. ELECTRONIC CODEBOOK (ECB) MODE 6

4. CIPHER BLOCK CHAINING (CBC) MODE 8

5. CIPHER FEEDBACK (CFB) MODE 11

6. A DES AUTHENTICATION-ONLY MODE 15

7. REFERENCES 17

8. DEFINITIONS , ABBREVIATIONS , AND CONVENTIONS 18

9. APPENDIX A: SAMPLE DES ENCRYPTIONS AND DECRYPTIONS ... 21

10. APPENDIX B: EFFECTS OF CIPHER TEXT ERRORS 27

11. APPENDIX C: CBC AND CFB FLOW CHARTS 31

12. APPENDIX D: EXAMPLES OF AUTHENTICATION-ONLY MODE 35

13. APPENDIX E: RECOMMENDATIONS FOR DES IV MANAGEMENT .... 39

\

1

1 . PREFACE

The algorithm for the Data Encryption Standard (DES)

was developed by the International Business Machines Corporation (IBM) . It was adopted by the National Bureau of

Standards (NBS) as a Federal Information Processing Standard

(FIPS) in 1977. FIPS Publication #46 [FIPS 46] specifies

the DES algorithm which is to be used within the Federal

government for the cryptographic protection of sensitive,

but unclassified, computer data. A number of techniques for

incorporating this algorithm into a cryptographic system

have been identified by both Federal and private organizations. These implementation techniques, external to the DES

algorithm, have come to be called the "modes of operation."

The Institute for Computer Sciences and Technology within

the NBS is proposing a Modes of Operation FIPS for the DES.

The purpose of this FIPS will be to describe several techniques for using the DES with sufficient specificity as to

facilitate the interoperability of equipment using these

modes

.

Four implementation techniques using the DES are

described in this document: the electronic codebook (ECB)

mode, the cipher block chaining (CBC) mode, the cipher feedback (CFB) mode, and the authentication-only mode. ECB is a direct implementation of the IBM algorithm (U.S. patents

#3796830 and #3798359); IBM also developed and patented

(#4078152) the basic concept of the CBC mode. The Federal

Reserve Board, with the technical assistance of the National

Security Agency, adopted an 8-bit CFB technique for experimental use on their nationwide data communication network.

The authentication-only mode is really an application of CBC

or CFB, but it is deemed sufficiently important to be included in a standard. The proposed FIPS is limited to these

four modes because they are the only techniques recommended

at this time in encryption standards being developed under

the auspices of the Federal Telecommunication Standards Committee . The purpose of this NBS Internal Report is to provide

an expedient vehicle for the dissemination of the technical

information being considered for the proposed Modes of

Operation FIPS.

The proposed FIPS will mandate only those characteristics necessary to specify the mechanics of implementing the

modes of operation. Requirements in other concomitant areas

which affect the security of a cryptographic system, e.g.,

key management or cryptographic synchronization, are not addressed in this document. They may be defined in other

security or application standards.

- 1 -
The American National Standards Institute has approved

the creation of a technical committee (X3T1) in order to begin drafting a national standard addressing the modes of

operation for their Data Encryption Algorithm (DEA) . The

Federal DES and the ANSI DEA use the same cryptographic algorithm .

- 2 -
2 . INTRODUCTION

Data to be cryptographically protected is called plain

text . Encryption is the process of transforming plain text

into cipher text ; decryption is the inverse mapping of cipher text to plain text. The encryption (E) of plain text

(P) under a key (K) into cipher text (C) is denoted by E(K,

P) = C. The letter D will represent the inverse transformation, so that decryption under K may be written as D(K, C) = D {K , E(K, P) } = P.

Binary data may be cryptographically protected using

the Data Encryption Standard (DES) [FIPS 46] in conjunction

with a cryptographic variable. A cryptographic variable for

the DES consists of sixty-four binary digits of which

fifty-six bits are used directly as a key governing the algorithm. The remaining eight bits are employed as an odd

parity check. A cryptographic period (or key period) is

that interval of DES operation during which the same key is

used between two or more cryptographic entities. Since the

DES has been publicly defined, cryptographic security

depends upon the security provided for the cryptographic

variable — both the key and its parity bits. Given the cipher text and the key, the plain text can be recovered easily.

Mathematically, the DES maps a 64-dimensional input

space over the field {0,1} onto itself. The number of elements in this space is two raised to the 64th power (2**64),

i.e., it consists of all possible 64-bit vectors. The cryptographic key space provides the user a choice of any one of

2**56 invertible (one-to-one and onto) mappings. A specific

DES input value can be mapped to one of 2**56 output values

-- the specific value depends upon the particular 56-bit key

chosen. The DES mapping has a complementary effect in that

if E (K , P) = C then E(K',P') = C* or equivalently E (K , P) = { E (K ' , P')}' where the apostrophe represents binary complementation .

FIGURE 1.

- 3 -
FIGURE 2. THE OES TRANSFORMATION

USING THIS OUTPUT AS THE NEW INPUT,

STEP #1 IS REPEATED 15 MORE TIMES

f = CIPHER FUNCTION

KS = KEY SCHEDULE FUNCTION

IP* = INVERSE OF IP

-4 ~
The DES is a nonlinear, iterative, block, product cipher. This product cipher mixes transposition and substitution operations in an alternating manner in order to be most

effective. Because this algorithm maps a 64-bit input block

into sixty-four output bits, the DES is classified as a block cipher. Iterative refers to the use of the output of

an operation as the input for another iteration or round of

the same procedure. Nonlinearity is introduced into the algorithm through eight S (substitution) boxes, each of which

maps six input bits into four output bits. A block diagram

of the encryption operation is illustrated in figure #2.

The cipher function, f, and the key schedule function are

described in detail in [FIPS 46].

The DES input and output (I/O) blocks are sixty-four

bit vectors with the least significant bit (LSB = 2**0) defined to be on the right and the most significant bit (MSB = 2**63) on the left. The bits of a DES I/O block are numbered from left to right: (1, 2, . . . , 64). When a 64-bit

cryptographic variable is entered into the DES key schedule,

its format in the key input block is: (1 , 2, . . .

, 7 , PI , 8 , 9 , . . .

,

14 , P2, 15 49 , P7 , 50 , 51 ,..., 56 , P8 )

,

where {Pi | i=l,

2,..., 8} are odd parity bits computed on the preceding seven

key bits.

There are two general techniques for incorporating the

DES into a cryptographic system: a block cipher and an additive or stream cipher. In both modes each bit of cipher

text is a function of every bit of the cryptographic key.

In a block cipher, the DES input block is a function of the

plain text to be encrypted and the DES output block defines

the cipher text. In an additive cipher implementation, a pseudorandom binary sequence is generated using DES output

blocks. The binary exclusive-OR operation, represented by a circled plus sign, combines this pseudorandom sequence with

the plain text to define the cipher text. This operation is

equivalent to bit-by-bit, modulo-2 addition (without carry).

Since the exclusive-OR operator is its own inverse over

{0,1}, the same pseudorandom binary stream, say 0, is used

for both the encryption of plain text, P, and the decryption

of cipher text, C; i.e., P ® 0 = C and C © 0 = P.

- 5 -
3. ELECTRONIC CODEBOOK (ECB) MODE

The most basic mode of operation for the DES is the

electronic codebook (ECB). The analogy to a codebook arises

because the same plain text block always pi

cipher text block for a given cryptograph

suming that a manageable subset of the DES

used, a list (or codebook) of corresponding

text pairs could be constructed.

In ECB encryption, the plain text da

D64) directly defines the DES input block

The input block is processed through a DES

been loaded with the appropriate crypt

The resultant output block (01 , 02 , . . .

, 064

)

as cipher text (Cl , C2 , . . . , C64 )

.

oduces the same

c key

.

Thus , a si nput spac e is

[ plain and c i pher

i block (D 1 , D 2 ,

. . ,

; (11,12 /

• • • / 164) . device which has

'graphic var i able

.

is used dir ec tly

The ECB decryption process is the same as ECB encryption except that the DES key schedule selection is reversed.

In general, the DES key schedule function generates a new

48-bit vector from the 56-bit cryptographic key for each of

the sixteen rounds of the DES algorithm. For a given cryptographic variable, let the sixteen key

vectors be denoted by {KS1, KS2, . . . , corresponding decryption process will

operation as encryption (figure #2), but

. . , KS 1 } will be successively invoked.

schedule encryption

KS16 } . Then, the

use the same basic

now { K S 1 6 , KS 1 5

,

An example of ECB

encryption and decryption may be found in Appendix A.

Since each bit of an ECB output block is a complex

function of every bit in the input block and the cryptographic key, a single bit error in a cipher text block will

cause the decrypted plain text block to have an average error rate of fifty percent. However, an error in one ECB cipher text block will not affect the decryption of other

blocks, i.e., there is no error extension between ECB

blocks. An example of the effect of cipher text errors on

ECB operations may be found in Appendix B.

If block synchronization is lost (e.g., a bit slip),

then ECB cryptographic synchronization will also be lost until correct block boundaries are re-established.

Since the ECB mode is a 64-bit block cipher, an ECB

device must encrypt information in integral multiples of

sixty-four bits. If a user has less than sixty-four bits to

encrypt, then the least significant bits of the unused portion of the input data block should be padded with random or

pseudorandom binary digits prior to ECB encryption. The

corresponding decrypting device will have to know when and

to what extent padding has taken place so that these padding

- 6 -
digits can be ignored or discarded after decryption.

A potentially critical weakness of the ECB mode is the

fact that the same plain text always produces the same cipher text under a fixed key. Thus, the compromise of the

plain text underlying any cipher text block results in the

compromise of all repetitions of this same text for the

remainder of the cryptographic period. This is sometimes

referred to as a codebook analysis problem.

FIGURE 3: ELECTRONIC CODEBOOK (ECB) MODE

ECB ENCRYPTION ECB DECRYPTION

PLAIN TEXT=

(Dl, D2, D64)

CIPHER TEXT =

(Cl, C2, C64)

DES ALGORITHM

KEY ENCRYPT

DES ALGORITHM

KEY DECRYPT

CIPHER TEXT =

(Cl, C2 C64)

PLAIN TEXT=

(Dl, D2 D64)

-7 -
4. CIPHER BLOCK CHAINING (CBC) MODE

CBC is a block cipher in which the plain text is

excl us i ve-ORed with a block of pseudorandom data prior to

being processed through a DES device (see figure #4). This

technique greatly reduces the codebook analysis problem associated with the ECB mode , and also provides an error extension characteristic which is valuable in protecting

against fraudulent data alteration.

In order to commence CBC encryption, the first DES input block is formed by exclusive-ORing the first data block

with a 64-bit initialization vector (IV), i.e., (11,12,...,

164) = (IV10D1, IV20D2, . . . , IV640D64). This initial CBC

input block is processed through a DES device producing a 64-bit DES output block which defines the cipher text,

(01 , 02 , . . . , 064 ) = (Cl , C2 , . . . , C64 ) . Then these first 64 bits

of cipher text are excl us i ve-ORed with the second plain text

data block in order to construct the second DES input block.

The next DES operation produces the second cipher text

block. This encryption process continues to "chain" successive cipher and plain text blocks together until the last

plain text block in the message is encrypted. The DES input

block at time t is the bit-by-bit, mod-2 sum of the plain

text at time t and the cipher text at time t-1 for t>l or

the IV at t=l. Appendix A contains an example of the CBC

encryption and decryption of ASCII characters and Appendix C

has a flow chart illustrating the basic CBC logic.

For CBC decryption, the first cipher text block is processed through a DES device using the decrypt operation,

i.e., the key schedule vectors are invoked in

order from the encryption process. The firsl

is exclusive-ORed with the CBC IV producing the first

text block. The second cipher text block i into the DES and the resultant output block is

ORed with the first cipher text block in or the second plain text block. The CBC decr^

continues to exclusive-OR the cipher text block at

for t>l with the DES

time t until the end

output block to obtain

of the message,

th e reve rse

output bl ock

f i rst Pi a in

th en en te red

exc lu si ver to pr od uee

io n pr oc ess

a t t im e t-1

in t ex t at

8 -
FIGURE 4: CIPHER BLOCK CHAINING (CBC) MODE

TIME=1 TIME=2 TIME=N

LEGEND

Di=DATA AT TIME i

li =INPUT AT TIME i Ci =CIPHER ATTIMEi

Oi = OUTPUT AT TIME i IV = INITIALIZATION VECTOR

® EXCLUSIVE-OR

- 9 -
The security of a CBC implementation depends, among

other things, upon the management of CBC initialization vectors. Some recommendations in this area are provided in Appendix E.

The CBC mode reproduces the same cipher text whenever

the same plain text is encrypted under a fixed key and IV.

In the ECB mode, the cipher text repetition characteristic

occurs at the block level; in the CBC mode, cipher text repetition is at the message level. If CBC users are concerned about this potential security problem, then their CBC

systems should incorporate a unique identifier (e.g., a one-up counter) at the beginning of each CBC message in order to insure unique cipher text within a cryptographic

period

.

Since the CBC mode is a 64-bit block cipher, it must

operate on a 64-bit input block with each CBC operation.

Thus, partial data blocks (< 64 bits) will require special

handling. For example, a partial data block may be padded

in its least significant bit positions with arbitrary binary

digits whenever the application environment can tolerate the

overhead. The decrypting CBC device will have to know when

and to what extent padding has occurred. This can be accomplished explicitly, e.g., using a control indicator, or implicitly, e.g., using constant length transactions. Another

suggestion for handling partial data blocks is to switch to

a 1-bit cipher feedback (CFB) mode in order to process the

final k < 64 bits of a message. The last CBC cipher block

would be used as an IV to initiate this CFB process. When

using this scheme, the last bit of the message should not

contain sensitive information.

In the CBC mode-, one or more bit errors within a single

cipher text block will affect the decryption of two blocks

-- the block in which the error occurs and the succeeding

block. If the errors occur in the n-th cipher text block,

then each bit of the n-th plain text block will have an

average error rate of about fifty percent. The (n+l)st

plain text block will have only those bits in error which

correspond directly to the cipher text bits in error. Of

course, if errors occur in the last cipher text block, then

the last plain text block is the only one affected. An example of the effect of cipher text errors in CBC operations

may be found in Appendix B.

If CBC block synchronization is lost, then CBC cryptographic synchronization will also be lost. However, cryptographic synchronization will automatically be reacquired

sixty-four bits after block boundaries have been establ ished

.

10
5. CIPHER FEEDBACK (CFB) MODE

The CFB mode is an additive cipher technique in which

the DES is used to generate a pseudorandom binary stream.

This stream is exclusive-ORed with the binary plain text: to

form the cipher text. The cipher text is fed back to form

the next DES input block. The pseudorandom binary stream is

sometimes referred to as a key stream, and the DES is then

called a key generator or KG. However, this terminology

will not be used in order to avoid confusion with the cryptographic key.

One through sixty-four bit CFB operation may be used.

A 64-bit initialization vector (IV) or starter input block

is used to begin CFB operations. A CFB IV is placed in the

DES input block so that any zero fill is 1 eft- just i f ied

.

This 64-bit input block is encrypted through a DES device

producing a 64-bit, pseudorandom output block. The DES device is operated once for each new k-bit (0 < k < 65) character to be encrypted. In all CFB implementations, the leftmost or most significant k bits of the DES output block are

used in the exclusive-OR operation. These output block

bits, (01 , 02 , . . .

, Ok ) , are exclusive-ORed with the

corresponding k bits of data, (D1,D2, . . . ,Dk) to form the cipher text: (Cl ,C2, . . . ,Ck) = (D1©01 , D2®02 , . . . , Dk®0k ) . In

order to define this operation when the length of the plain

text character to be encrypted is less than k bits, zeros

are concatenated to the left hand side or most significant

bits of the plain text. Obviously, users must agree on the

representation of a plain text "character." Bits (Ok+1,

0k+2, . . . , 064) of the DES output block are discarded.

The k bits of cipher text are fed back to the LSB positions

of the DES input (I) block such that:

Bits at time t > Bits at (t+1)

I [k+1] > 11

I [k+2]

•

>

• 12•

•

164

•

• >

•

I [64-k]

Cl > I [6 4- ( k-1 )

]

C 2

•

>

•

I [64- ( k — 2 )

]

•

•

Ck

•

•

• 164

\ - 11 -
FIGURE

5:K

BITS

CIPHER

FEEDBACK

(CFB)

MODE I

COX t—

L*- to

— 15 Q£

toZ _ o_ u_ > t—3 LU o X < oz h- h-Z o(—

t—to

Cd o_ o u >- u LU u. oc > LU u >- h- LU i z < o < o 0£LU 1—

h- i—< Z1 1 1

Q-

>- z M o

OL —i u

X < o Z u H"- LU O

_j

1—z

CJ

LU o

ft— co to — 3 X 3 00 to u

n. i O Z

'N > CO

U<

oc<XUX

CLuZ< O z<X o ~

r~

O

s—

*-• < < c* Q

CS

to

to

to

NOZ

Q.o — t

oQz

0£. < £ Z

VJ LU < X

OC “ <Xu X

l—o

CO oc to o m > O to ^ 3 a u Z X < m X “

Ck£ £ X U ^ < O

O'<Xu

CO3O z ?

Ol cO ± X - o

>-

Xu< - ^ 1

u- z; *— zo

-12
As an example, consider an 8-bit CFB implementation and

an IV with forty-eight pseudorandom bits. After each encryption, the eight cipher bits are fed back into the DES

input block such that:

AFTER

ENCRYPTION # THE DES INPUT BLOCK CONTAINS:

0 (0,0, 0,0, 0,0, 0,0, 0,0, 0,0, 0,0, 0,0, 1,2, ,47,48)

1 (0,0, 0,0, 0,0, 0,0, 1,2, ,47, 48, Cl, C2, ,C8)

2 (1,2, ,47, 48, Cl, C2, ,C8,C9,C10, ,C16)

After the eighth encryption the entire 64-bit IV will have

been shifted out of the DES input block. Let the first

character be a seven-bit ASCII character plus parity denoted

by (P , b7 ,b6 , . . . ,bl ) . If the first DES output block is

(01 , 02 , . . .

, 064 ) , then the first cipher text character will

be (C1,C2, . . . ,C7,C8) = (P®01 , B70O2 , . . .

, b2©07 , bl©08 ) . Appendix A contains a detailed example of 8-bit CFB operations

and Appendix C has a flow chart diagramming the basic CFB

procedures

.

The security of a CFB system depends, among other

things, upon the management of CFB IVs. Some recommendations in this area are provided in Appendix E..

To protect against undetected bit manipulation of the

last k-bit cipher text character using k-bit CFB, the last

character to be encrypted must consist of error detection,

terminal flag, or permanently fixed data.

In CFB, each cipher bit is a function of one bit of the

DES output block and one bit of plain text. Therefore, any

bits of a CFB cipher text character may be changed without

affecting the decryption of other bits within the same character so long as the bits which are fed back at the encrypting and decrypting stations are the same. An application of

this characteristic would be the deletion of encrypted parity bits and their replacement with a new parity computed on

the cipher text. This feature is useful in networks which

are sensitive to parity checks.

Bit errors within one CFB cipher text character will

affect not only the decryption of the garbled cipher text

but also the decryption of succeeding characters until the

bit errors are flushed out of the CFB input block. The

first affected plain text character will be garbled in exactly those places where the cipher text character is in error. Succeeding plain text characters will experience an

- 13 -
average error rate of about fifty percent until all errors

have been shifted out of the DES input block. Assuming no

additional errors are encountered during this time, the CFB

decryption device will then automatically regain cryptographic synchronization. This characteristic is sometimes

referred to as a limited error extension or a selfsynchronizing capability — depending upon the point of

view. In the previous 8-bit CFB example, errors in one cipher text character affect the decryption of nine characters. A detailed example of cipher text errors in CFB

operations may be found in Appendix B.

If k-bit character boundaries are lost during decryption, then cryptographic synchronization will be lost until

a cryptographic restart (new IV) is initiated or until after

character boundaries have been re-established. In the

latter case, if 64 (mod k) = 0, then resynchronization will

occur automatically after 64/k characters with proper boundary definition have entered the DES input block; otherwise,

one additional character will be required.

The encryptio

invoke the DES key

both processes wil

duces a partial i if E [K

,

(PI , P2 i • (Cl , C2 , .

.

. , Cn)

]

= represent k-bit Pi

dorandom) charac te

n and decryption processes in the CFB

schedule vectors in the same order,

1 use {KS1, KS2 ,. . . , KS16}. This

nvolution under the same IV and key;

..,Pn)] = (Cl ,C2, . . . ,Cn) , then

(P1,N1,N2, . . . ,N (n-1 ) ) where P, C,

a in text, cipher text, and nonsense ( rs, respectively.

mode

i . e . , proi . e . , E (K , and hi pseu9
6. A DES AUTHENICATION-ONLY MODE

The DES algorithm may also be used for the authentication of plain text. This technique is useful in applications which require maintaining data integrity but do not

require that the plain text be protected from disclosure.

The authentication-only mode protects against bit manipulation within the data as well as the insertion and deletion

of messages, and the replay of a previously valid message.

In the authentication-only mode, two message authentication

codes (MACs) are independently computed on the same data

one at the data source and one at the data destination.

This data consists of a unique message identifier (MID) and

the text to be protected. If the data source MAC and the

data destination MAC are in agreement and if the MID agrees

with its expected value, then the plain text is accepted as

authentic at the data destination. The authentication-only

format is depicted in figure #6. The MAC must be generated

using either the CFB or the CBC mode.

FIGURE 6:

AUTHENTICATION-ONLY FORMAT

FIELD 1 FIELD 2 FIELD 3

MID

PLAIN

TEXT

MAC

In order to commence CFB authent

unique message identifier is used as

tor. The plain text is encrypted in

except that the cipher text is not

crypting device. After the encryptio

text unit (character or block) , the

back into the DES input block as if a were to be encrypted. Then the DES

more time and the left-most or most s

< k < 65) in the next DES output bloc

ication operations, a an initialization vecthe normal CFB manner

communicated to the den of the final plain

last cipher text is fed

nother plain text unit

device is operated one

ignificant k bits (0

k are used as the MAC.

To begin CBC authentication operations, the MID is

again used as an initialization vector. However, for this

application the first plain text block to be encrypted is

the all zero block, i.e., the MID alone defines the first

DES input block. Thereafter, the plain text is encrypted in

the normal CBC manner. The CBC MAC is defined to be the

- 15 -
left-most or most significant k bits of the DES

block resulting from encrypting the final plain text

Messages which terminate in partial data blocks are

padded on the right (LSB) with zeros.

output

block

„

to be

The MID , plain text, and the MAC are conveyed to the

data destination; the intermediate cipher text is not

transmitted. The probability that one could randomly select

a correct k-bit MAC is l/(2**k). For most applications,

MACS of at least 24 bits are strongly recommended. Two examples of the authentication-only mode may be found in Appendix D.

In general, the MID is a unique and deterministic message identifier within a cryptographic period; the MID

should also be varied across cryptographic periods. The

value of the MID will be checked by the recipient of an

authentication-only message to verify that messages have not

been deleted, inserted, or replayed. The uniqueness within

a cryptographic period may be achieved through the use of a one-up binary counter. MID values are not to be repeated

within the same cryptographic period; this constraint also

applies to multiuser environments under control of a common

cryptographic key. The MID variation across cryptographic

periods may be satisfied by selecting a random or pseudorandom starting value from the total range of a "within'"'

counter. In using this approach it is recommended that only

a small (say << 5%) segment of the MID’s total range be used

within any key period. Another acceptable technique would

be to form the MID by concatenating a unique message identifier together with a unique identifier for each cryptographic period, e.g., a second one-up binary counter could

be used for this purpose. r

A MID is not encrypted. However, whenever MID values

are exchanged through an unsecured channel to establish or

re-establish MID synchronization, then these values must be

protected. This protection includes the detection of bit alteration, the insertion of bogus messages, and the replay or

deletion of valid messages.

16 -
7. REFERENCES

[FIPS 46] Federal Information Processing Standard

Publication 46, Data Encryption Standard.

1977 January 15; FIPS PUB 46: 18 pages.

Available from: National Technical Information

Services; U.S. Department of Commerce;

Springfield, Virginia 22161; NBS-FIPS-PUB-46

.

S

- 17 -
8. DEFINITIONS, ABBREVIATIONS, AND CONVENTIONS

AUTHENTICATION-ONLY: A DES technique for

tegrity of plain text which does not have

from disclosure; see section 6.

protecting the into be protected

BLOCK: A binary vector consisting of sixty-four bits numbered from the left as 1, 2, ... , 64.

CBC: Cipher

CFB: Cipher

CIPHER TEXT:

block chaining; see section 4.

feedback; see section 5.

Encrypted data.

CRYPTOGRAPHIC KEY: The 56 random bits of the cryptographic

variable which are used to govern the DES device. Also simply called KEY.

CRYPTOGRAPHIC PERIOD: That period of DES operation during

which a unique data-encrypt ing key is used between two or

more cryptographic facilities. Keys from different cryptographic periods are independent. Synonym: Key period.

CRYPTOGRAPHIC VARIABLE: The 64 bit vector containing the

56-bit DES key and its eight associated parity bits.

Synonym: Key Variable.

DECRYPTION: The process of changing cipher text into plain

text. Verb: DECRYPT.

DES: Data Encryption Standard; specified in [FIPS 46]

.

DES DEVICE: The hardware used to implement the DES algorithm. This is usually an integrated circuit chip which is

sometimes referred to as a "crypto-engine."

DES INPUT BLOCK: A 64-bit data vector that is entered into

the DES device.

DES OUTPUT BLOCK: A 64-bit vector that is the final result

of a DES device.

ECB: Electronic codebook mode; see section 3.

- 18 -
ENCRYPTION: A process of changing plain text into cipher

text. Verb: ENCRYPT.

EXCLUSIVE-OR OPERATION: the

without carry of binary

represented by a circled + .

bit-by-bit modulo-2 addition

numbers. This operation is

INITIALIZATION VECTOR (IV): A 64-bit vector used to help

form the initial DES input block for the CFB and CBC modes

of operation; a 64-bit cryptographic synchronization vector.

KEY: Cryptographic key; the 56 random bits of

graphic variable.

the cryptoKEY SCHEDULE FUNCTION: A logical unit within the DES algorithm which generates a different 48-bit vector from the

64-bit cryptographic variable for each of the sixteen rounds

of the DES process.

LEAST SIGNIFICANT BIT (LSB) : The right-most bit of a binary

row vector. Synonym: Low order bit.

MAC: Message authentication code; see section 6.

MESSAGE (MSG): A generic term used to describe a logical

data entity. In general it is an ambiguous term; therefore, for specific applications it should be precisely defined .

MID: A message identifier used with the authentication-only

mode

.

MOST SIGNIFICANT BIT (MSB) : The left-most bit of a binary

row vector. Synonym: High order bit.

OCTET: A group of eight binary digits numbered from left to

right: 1, 2, ... ,8.

PLAIN TEXT: Decrypted data or data to be encrypted.

PSEUDORANDOM BINARY PROCESS: A deterministic technique for

producing a sequence of binary digits which satisfy the statistical properties of a random bit stream.

APPENDIX A

SAMPLE DES ENCRYPTIONS AND DECRYPTIONS

- 21 -
22
A • A

A

A 1 TJ T3

XA 1 •31 0 O

A

A r—J 1 roX c A 1 I-" CM CMA

A X* 1 00 CO CO

A 1 0 m

OA

A f X 00 cn

A 1 CM co CO

A

A • \ X T3 CO

A j ro T3 0 A

A • Eh » cc

U ro

A i p' CO CO

A

A • X • 1—1 X co

A Eh t as as

X

A

A CO 1 X in

AX 1 CO CO co

A

A cc Eh 1 x ro

X

A

w I 0 X 0 A

A

X 1 cu

X cu

A Eh ! CM r- CM

A

A cc, 1 cc

a

X

A 1 p' 0 CM

A

A r~ CO 1 X

X 00

A 2 1 p' CM P'

A

A

X cc 1 o m

X

A

X 1 X in

XA

A cx t—1 X 00

A <?* 1 co co CO

A

A CO s o t—1

T3 ro

X

A

X 1 <U 00 cc

A

A o • * cj • ro rX

A

a j CD CO

A

A o AA

A 2 i

1 c A

A

A rH

O

A

A

A (T »rH

X | TJ T3

XAX 1 c 0 A

Am JJ CJ i roX o A rjl 1 p~ CM CMA

A <_> Cj <c o » or CO CO

A 0 1 0 inOA

A CO o jj

X 1 X 00 inA

J 1 CM co COA

A '— CO!

O CO ! X T3 co

A 00 1 ro T3 0 A

A c 1 CO

U ro

A t p~ CO CO

A

A tc a» Eh 1 1—I X co

A Eh 1 as as 1—1 A

A E rH 3 1 X in

A 0 1 CD co co

A

A o • •rH fO 04 1 x ro

x

A • 04 1 0 0 A

A 2 T T3

X

g Eh 1 a> i—i

<uA T2 Eh 1 CM p- CM

A

A o CO CU •rH 03 1 cc

O

XA <u 3 r 0 CM

A

A l-l f' JJ a) o o 1 X

X 00

A

X o 1 PH CM O'A

A Eh o u

x a> 1 o m

XA o 1 X in

X

A

A < u 0)

X T3 CO 1 i—\ X 00A cu

w 1 CO CO CD

A

A cc rH (0 CO 1 TJ roX

A f—1 w 1 cu 00 CO

A

A CO CJ cu cn

x

a 1 ro pX

A <u

Q I •O’ co CO

A

A 04 1—1 w •»H d)

AwA

A o 2 X

A

A

A o c A c A A Cl4 cc <D x o c to 1 o o A cu X X 1 T3 T3 X A V o Eh CU 0) 2 **h o 1 r~- CM CM V cu cu CJ 1 ro X O V V cj X T3 s o 1 o m o V X T3 o 1 00 CO (0 V V CO CO o C J 1 CM CD CO V u X i X 00 in V V u X w x cu CO 1 "0 T3 o V w X 00 1 X T3 is V V Q CO H3 <c Cj x 1 CO co V CO CO 1 00 O X V V o x <Ti o x Eh 1 as as X V X CT> Eh 1 1—! X 00 V V T. CO 00 X -rH X 1 CO CO CO V 00 =3 1 X m V V 5C cu r~ u Cu 1 o x o V <u p~ 04 1 •^r ro V V CO Eh JJ cc <u 5 2 1 CM P* CM V X co 2 1 cu X CU V V CO CC m TO X 1 r- o CM V CO in H 1 <0 O X V V Q Ixi Jj o a) l CM r~~ V X 1 X X oc V V o w ro O Vj i X in X V w ro 1 0 in X V V CM CC CO i CO CO CD V CM CO 1 X X CO V V CO Jj rH X CO i a> 00 CO V X 1—1

Ci3 1 T3 ro

X

V

V

Xa o X

W

Q i x CO CO

V

a o Q 1 ro p~

X

V

V cu >1

O Sh

V >4V

V T. ij II CO CU

V

u II

V

V < u < X

V o V

V

X c o i x o o V cu 1 T3 T>

XV

V CO cu CU CO i CM CM

V TT 1 roX 0 V

V >1

X

X i o in

O

V >1 1 00 CO cC

V

V 2 (!) a;

X <T5 i CM CO CO

V cu <u 1 X 00 in

V

V < x

X i ro T3 o V X, tc: 1 X T3 CC

V

V JJ U)

U i r-H CO CD

VX Eh 1 oc

O CO

V

V • rH Eh i as as <—1 V

X 1 X

X CO

V

V c X

X i CO CD CO

V c w 1 ^3*

X in

V

V •rH ' X -rH CO i o X o V •rH Eh 1 ^T ro *sT

V

V

u

X

X Eh i CM p» CM

V

u 1 CU

X <u

V

V <D •rH <U 1 i p" o CM

V a' •rH cc 1 CO

O

X

V

V 'O r*

X

C 2 i PH CM pHV t:

X

w 1 X

X 00V

V o a <L' i—t i X

m

X

V o a OC 1 c in

X

V

V 6 (0

C > <C i CO co CO

V E CO 04 1 XX 03V

V

u •rH

J i CD 00 CO

V

u

H 1 T3 ro

X

V

V ro U> rc CO a. i X co CO

V OQ US CJ 1 ro PXV

V

u o i

l V o o V

V CO JJ 04 cu

V

w

XV

V

a CO CO i V

a

H 1 V

V CU >1 CU CU s: i rH CM ro

V cu >4 s 1 X CM CO

V

V

x

u

XX

X i V

X Vj 1—1 1 V

V Eh o E- Eh i V Eh CJ Eh 1 V

23 -
A

AA

A • A

A

A X-N 1 LD CD rH

A 1 •vT o A

A

r

—• 1 o SC CU

A 1 CN

X

A

A

X 1 00 as o>

A 1 o UO o A

A 1 X o X

A 1 CN LD LDA

A • 1 X i—i

•^r

A 1 00 TO CJA

A • Eh 1 X CU o A | P" LD LD

A

A • X ! O' uo 00

A Eh 1 as Os i—1 A

A

w 1 Os r- TO

A

X 1 SO SO LD

A

A LD Eh 1 CN o TO

A Cd 1 o o A

A

X 1 1—1 X 00

A Eh 1 CN ("

X

A

A CD 1 CD CU

X

A 1 CHO

X

A

A r~

u 1 ro

X UOA 2 1 I'" CN f"

A

A

X 30 1 LD

X

A

H 1 X UO

XA

A a, 1 CO CU ["

A c 1 LD LD LDA

A = O 1—1 1 ["

X o A

X 1 CU CO LD

A

Aw • — cj 1 o CO TO

A a, 1 LD LDA

A

QA

A

A o r—

nC

AA

A 2 rH

O

A

A

A CD *H x: 1 LD CDX

A

x 1 X LD ID

A

A

X CJ 1 o SO CU

A CJ 1 as CU -31 A

A cj Uj CD o 1 00 as as

A o 1 TO TO UO

A

A CQ

O

X

J 1 X o XA

X 1 CU as LD

A

A CJ

X o CD 1 X -H -*3*

A CD 1 00 o X

A

A

— c 1 X CU

O

A 1 TO OL 00

A

A CU Eh 1 O' uo 00

A Eh 1 as o A

A

u £ rH

X 1 Os C" TO

AX 1 X

X rH

A

A 2 • •rH ro CU 1 CN o TO

A • CU 1 00 LD o A

A 2 *—t X

X

g Eh 1 X

x OO

A TO Eh 1 in LD

X

A

A o 2 CU •iH

X 1 VD CU

XA CU

X 1 1—1 LD o A

AMM 4-> CU cj o 1 00

X UO

A

X o 1 CN rH IDA

A Eh < CJ

X CU 1 LD

X

A o 1 X o *3

A

A < 2C CL!

X

X CO 1 00 CU r*

A CU CO 1 UO <u OC

A

A Cd

O rH CD Cd 1 O'

X

O

AX Cd 1 CJ

X r»"

A

A cd CU 10

X

Q 1 cj as 'o

A CU

a f uo ID

X

A

A CL,

X CO •rH

O

A 01

A

A o cj

X

AA

A o c A c A A tu uJ CU X X o c X 1 X U0 CD A CU X X x ’ uo ID i—! A V o CD CU CU CU 2 ’rH CJ 1 as CU V CU CU CU o ! CJ LD CU V V X! X X s o 1 X X UO V X TO TO o 1 CO CD as V V in DC CJ cj C X 1 <U Os CD V CJ CJ X ! X C X V V w Cd CO X X CU CD 1 00 o TO V CO X X CD i TO X V V Q as ID CD CD L-l X 1 X Os 00 V CD CD CD X CU c V V o CU x (Ti O o x Eh 1 as o V r2 O'. O Eh • Os uo X V V 2 i—i

00 Os

X -H

X 1 X

X

X

V 00 as

X 1 as i"-

X

V

V cj CU r- 00

X CU 1 00 SO o V CU f" 00 CU \ CN o X

V

V cn 4J LO p" CU 5 2 1 uo soX

V

X LD t-~ 2 1 rH TOX

V

V

ww CDX LD

X

M 1 ,—i

SO o V CD UO LO

w t LD cu

x

V

V

Q ao 4-> uo

O CU 1 CN rH ID

VX uo 1 X TO

V

V E-> CO CO

U

X 1 X

O «ST

V CO OO 1 UO

X H31 V

VX CO CD CO 1 UO CU 00

V CN OO CO ! CO CU f"

V

V fcj 4J ,-H CM

M

w 1 CJ

X

X

VX

X CN Cd i| ; r"x o V

V

O a,

O ,—1 X CO

a 1 uo CD

X

V CU o X

Q 1 O as

X

V

V >1 CJ

V On

V

V

w i-t II II CO CU

V Lj II II

V

V

J

u <cx

V cjV

V CL, c u • x1 O o V CU 1 t-O (D rH

V

V s <u L-, CL' CD 1 O'. CN CN

V TO U, CJ LD cu

V

V < ON o X Sh 1 o UO CJ

V On o 1 cc as as

V

V

X CU CU

X

X CD ! CN LO LD

V (U CU

X 1 X o X

V

V

ux o X • 00 'O

a

V

XX o 1 TO rH

V

V -u (U CO o < O' SO LDVX CU Eh 1 X1 cu o V

V 2 > •rH

X 1 as as rHV > X 1 a uo

XV

V < c X

X I so so LD

V c Cd 1 as rX

V

V •H c X *rH Cd 1 o OV •rH c Eh 1 CNO TO

V

V o o X

X Eh 1 CN f" CN

V CJ o 1 1 1 TO

X

V

V CU •rH •rl CU 1 1 O' o CN

V CU •rH •rH Cd 1 LD CU

X

V

V

X

X

x

C 2 j r- CN r~

V TO

X

X Cd j X

X

V

VO

a CD CU

w 1 X UO

X

V

O

a CD

X i UO

X ^ V

V £ CD

N c > <c 1 so SO LDV E CD

N CU 1 00 (U rV

V U, •rH •rH

X 1 CU cn LD

V u< •|H

X l ["•X o V

V CJ CT> rH ro

W CU 1 SO LDV CJ as

X CJ 1 CJ as

x

V

V DQ o CD f—1 V CD o CD

V

V CJ 4-1 •rH O, CU

V CJ

X •rH

V

V

a

X CO Cd 1 V CU

X

X 1 V

V a) •rH CU CU 2 1 »—iCN noV CU On • H 2 1 X ro

V

V

X

u c X

X

M 1 V

X Uj

C

X l V

V

V

M Eh eh Eh 1 V Eh CJ

M Eh 1 1 V - 24 -
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

DES MODES OF OPERATION

AN EXAMPLE OF THE EIGHT-BIT CIPHER-TEXT FEEDBACK (CFB ) MODE

The 8-bit CFB mode in the encrypt state has been selected.

Cryptographic Key

Initialization Vector

0123456789a be def

1 234567890abcdef

The plain text is the ASCII code for "Now is the."

These seven-bit characters are written in hexadecimal

notation (0 , b7 , b6 , . . . , bl ) . The © represents bit-by-bit,

modulo-2 addition.

TIME DES INPUT BLOCK DES OUTPUT BLOCK P © O C

1 1234567890abcdef 3494ccf2bda243a6 4e © 34 = 7a

2 34567890a bcdef7a bd914d9 386658 541 6f © bd = d2

3 5678 90 abed ef 7 ad

2

adaf3c45c53flf92 77 © ad = da

4 7890a be def7ad2da e3a3acc86c429d97 20 © e3 = c3

5 90abcdef7ad2dac3 5cblebb51b70388d 69 0 5c = 35

6 abedef 7 ad2dac3 3 5 f 3af29ce4cb9661f 73 © f 3 = 80

7 cdef7ad2dac33580 aa22a74f73723adl 20 © aa = 8 a

8 ef7ad2dac335808a 92d94ccel88fl5af 74 © 92 = e6

9 7ad2dac335808aeS 4fbbeal51d3cfc54 68 © 4 f = 27

10 d2dac335808ae627 6dabadlfdba3bc3b 65 © 6d = 08

<<<< V V V V V V V V V V V V V V V V V V V V V V V V V V A A A A A A A A A A A A A A A A A A A A A >>>> >>>>>

The 8-bit CFB mode in the decrypt state has been se 1 ec t ed • Cryptographic Key = 01 234 567 8 9 abedef

In i t ialization Vector = 1234567890a bedef

TIME DES INPUT BLOCK DES OUTPUT BLOCK C © 0 = P

1 1234567890abcdef 3494ccf2bda243a6 7a © 34 = 4e

2 34567890abcdef7a bd9 14d9 386658 54

1

d2 © bd = of

3 567 890 abedef 7 ad

2

adaf8c45c53flf92 da © ad = 77

4 7890abcdef7ad2da e3a3acc86c429d97 c3 © e3 = 20

5 90 abedef 7ad2dac3 5cblebb51b70388d 35 © 5c = 69

6 abcdef7ad2dac335 f3af29ce4cb9661f 80 © f 3 = 73

7 cdef7ad2dac33580 aa22a74f73723adl 8a © aa = 20

8 ef7ad2dac 3 35808a 92d94ccel88fl5af e6 © 92 = 74

9 7ad2dac335808ae6 4 f bbeal 51d3cfc54 27 © 4 f = 68

10 d2dac335808ae627 6dabadl f dba3 be 3 b 0 3 © 6 a - 65

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- 25 -
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

DES MODES OF OPERATION

AN

The

EXAMPLE OF THE

1-bit CFB mode

ONE-BIT CIPHER-TEXT FEEDBACK (CFB) MODE

in the encrypt state has been selected.

Cryptographic Key

Initialization Vector

0123456789a be def

1234567890abcdef

The plain text is the ASCII code for "Now."

These seven-bit characters are written in binary as

(0 ,b7 ,b6 , . . .

, bl ) . The DES input and output blocks are

written in hexadecimal notation. The © represents

bit-by-bit, modulo-2 addition.

Note: A draft, ANSI X3S3.8, link encryption standard

requires that the bits of an ASCII character be processed

in the reverse order of this example for 1-bit CFB.

This draft data communications standard is designed for

the transmission of ASCII characters in the standard,

serial-by-bit manner ( bl , b2 , . . .

, b7 )

.

IME DES INPUT BLOCK DES OUTPUT BLOCK P © 0 — c

1 1234567890a bedef 3494ccf 2bda243a6 0 © 0 = 0

2 2468acfl21579bde 0e3c58dl6a551826 1 © 0 = 1 3 48dl59e242af 37bd 87647 b405d0b8cdf 0 © 1 = 1 4 91a2b3c4855e6f7b e91173c434165ae0 0 © 1 = 1 5 234567890abcdef7 ca46c7d8c3aab695 1 © 1 = 0

6 468acfl21579bdee c3c832f66747157d 1 © 1 = 0

7 8dl59e242af 37bdc 7dd595ccl0590044 1 © 0 = 1

8 Ia2b3c4855e6f7b9 6fb8b7e872332de4 0 © 0 = 0

9 34567890a bcdef72 9c91cbdde38c8 104 0 © 1 = 1 10 68acfl21579bdee5 fc4307dld4e0b047 1 © 1 = 0

11 dl59e242af 37bdca 5fb5a8881bc850dd 1 © 0 = 1 12 a2b3c4855e6f 7b95 57bba20ef 9c0 25bd 0 © 0 = 0

13 4567890a be def72a 5eal4c224e01dc2c 1 © 0 = 1 14 8acfl21579bdee55 8e869e2277f 5alad 1 © 1 = 0

15 159e242af37bdcaa f68135d6b7585f91 1 © 1 = 0

16 2b3c4855e6f7b954 dc6d28bbb906121

2

1 © 1 = 0

17 567890abcdef72a8 3d959a3e4dlleb9b 0 © 0 = 0

18 acfl21579bdee550 32747 b8 355 a832bf 1 © 0 = 1

19 59e242af37bdcaal eb5598e0a949d791 1 © 1 = 0

20 b3c4855e6f7b9542 e6308121b905adbd 1 © 1 = 0

21 67890abcdef 7 2a 8

4

f7998d0e85a6661b 0 © 1 = 1 22 cf 121579bdee5509 Iccf6e6bef 3d34e5 1 © 0 = 1 23 9e242af 37bdcaal3 Ic7da296b765e487 1 © 0 = 1 24 3c4855e6f7b95427 bbfdbec304117d48 1 © 1 = 0

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- 26 -
APPENDIX B

EFFECTS OF CIPHER TEXT ERRORS

- 27 -
AA • * A A 1 00 O O A A f 1 p « 0 CN CN A A X CO • • 03 in CJ A A p CO 1 CN vo VO A A • O r •r—1 p ' X 03 CJ A A • P '.j • 44 I-H 0 ! 44 vo VC A A • P p p Eh • CO X A A 0? 0- 0 CJ X p X < 00 10 X A A x CD 0 0 X 0 0 0 Cd t <53* '— A A x to CN X p X P F-i ' LD O' 03 A A c CQ P 0 p 1 LO O OJ A A r~ 0 r- c P X 2 1 CO CN A A X! X ai 4-1 44 •rH 0 0 0 M 1 0 n 44 A A •k 0 CD O O p X p C ' 0 vo X A A O 0 03 0 Du X 1 00 CO X A A s -—- c CM P >. 0 •rH p a ' CQ vo X A A • 0 O' •rH P P 0 u Q 0 A A C 0 0- X •rH O p CO X A A 1—1 O X 44 rH 0 0 CQ .X a * A A 1—1

•rH CO

X •rH

a

X CJ 0 •rH

x ' oc 0 0 A

A (0 p CO 0 0 X

Xp Cd 0 CJ CJ ! O CN CN

A

A Cd 0 0 0 0 0 rH c 1 03

n

O

A

A

Q P p

X s 0 X 0 0 X 0 X 1 CN vo

XA

A 0 O 0 0 0 —1 C

X OQ 1 X 03 CJ

A

A s 4-1 c -X

O 0 p

p a, 0 p

p 1 44 vo

XA

A 0 P CO

a 0 E X Eh 1 VO

X

A

A CQ CD rH 0 3 0 c 0 >1

X 1 00 vo

XA

A CJ • e 0 rH 03 0 0 CO

X •rH

p

X C4 1 TT 0 A

A 2 Cd 03 •rH E X 0 O

p 0 X Eh 1 LO O' CN

A

A o <!'p •rH P X 0 pp 03 3) 1 in 0 CN

A

A

M Cd

p

u

p

a1 1 p

p

O •rH 0 0 O 1 VO CN O'

A

A E- ac

u 0 0 X >1 rH •rH

p •rH ? X P 1 0 n 44

A

A < E-* 0 X 03 0 p •rH 5 0 44 DU CJ CQ 1 0 voX

A

A cc rH -p 0 p 0 3= •iH CO •H 0 Cd 1 CO 00

X

A

A

w

Q (I)X 0 p 0 O

p

O 4-1

a 1 CQ vo vo

A

A cu 2 m

w 0 p 03 -X

O 0 0 44

A

A o < •rH

X 0 u

pp a,p P 0 A

A c X 0 0 p 1 CO

p 0 * A

A &uu3 0 5 Ca > 1—1 0 >. 0 X CO 44 Cd 1 0 03 44A

V o cc 0 O •rH •rH 0 Xp CO

p

X 0 u ! CQ 44

O

V

V 0 X 2 0 s X c p •rH P 0 0 03 0 1 00 VO 0 V V cq DC c m p •rH •rH X •rH 0 a X 1 X 00 n V V Cd CC w a) p X 03 X X p X 44 rH X CQ ! 44 03 0 V V Q Cd 0 p p CO cq rH 0 0 p O X 0 1 00 O CQ V V o x O p p s 3 p X p P <Ti Eh 1 X 44 00 V V 2 E-* 4-1 •rH •rH O CO 0 0 C 0 00 3) ! 44 n V V X <D u 44 0 X p 0 3 Id X O X r-~ Ou 1 CQ V V cq Cd 4-> 0 3 CO 0 p X p •rH p x 2 ! 0 X 0 V V Cd fH 0 03 0 1—1 X Eh p LD M 1 0 CJ 44 V V Q P O CD X 0 P Du X • 0 a >1 t 44 X 00 V V cc. W O P P > X • rH 0 P p >. 44 CQ 1 O n 44 V V Cd 0 0 O 0 • X 0 p •rH CN CQ f 1—1 X 00 V V a: P 1—1 C P p rH P 0 z 0 P 1—1 Cd 1 03 CQ 44 V V a, a M CO •rH a CC X C P 0 C O a 1 CQ O- 44 V V X CJ p 0 p CJ 0 03 0 V V CJ p CQ CD p p 0 Cd p 0 c • 03 II V V 0 < P 0 p X X p •rH X 0 •rH •K V V 0 O P 0 a c 0 0 0 0 X 1 0 03 44 V V 03 0 fO O 0 •rH 0 p ou rH 0 P O 1 CQ 44 O V V x P 0 O a 1—1 P !>-i ! 00 VO 0 V V 0 p 0 p 0 c c >1 X P 0 111 X 00 n V V X X 0 X 4H •rH •1-* p 03 CJ 03 tx 11 4U 03 0 V V P w O X p O X 0 4-1 0 CO 0 0 Eh 11 00 O CQ V V •rH O p 1—l •rH P •rH 4-1 CO X 11 X 44 CO V V C P pi -X • rH c- U_’ CL. X 44 •—1 Cd 1l 44 n V V •rH P •rH M 0 O 3n p 0 Eh 11 ^ CQ V V X X M O C3 aH P 0 O 1l 0 1—1 0 V V a) a> 1 CJ 03 rH /H rH CJ c P P •rH CC 1l 0 O 44 V V 03 p c CQ 0 X CO • r—' 0 0 •rH O 0 X Cd 11 44 X CO V V 0 CD c 0 >—» «T« p 03 c a 23 1} O n 44 V V e £ > P p p c 0 CO CO 0 a, 11 X X 00 V V •rH CD P CO CO O 0 E 44 p 0 .y p M !1 03 CQ 44 V V CQ 0 CO co C p P a•rH O 0 03 CO D"> C J !1 CQ O' 44 V V U rH 0 •rH •rH P CO X p •rH 0 V V Cd a, CD 1—1

4H 0 0 0 X!p _X

p

p

V

V CO

r

p

p CJ 0 CJ 0 a, Cd j|1 V

V <D 0 CD 0 0) 0 P p

a

O 0 P 2T 11 X CN CQ

V

V

XxX

X ro

X rH 0 Du rH

r—1 1—1

CO

p

M 11 V

V E-« Eh Eh Eh s Eh CQ 0 0 X ro

X < CJ Eh 1 1 V - 28 -
A • * * A A 0 • 1 0 CO o A A rH > .y 1 »X CM CM A A X 0 X u 1 in U A A X O o 1 X <x CD A A • O c rH • 1 CM 3 U A A • 4-1 3 o ><x CO CO 1 0 VD CD A A • i—

•rH

X

X .y Eh 1 0 <n i—

A

A •* 3 3 X •rH CO •X o X 1 X CD CD

A

A co 0 o a rH •H

CX • CO o w 1 a ^r

OA

A xi cn

x >H •rH

X *H

X

X

X rH £h 1 o p- CM

A

A - c to

X • X

X 0 o X o o X 1 CO o CMA

A P- 0 o 3 0 rH •H

X 0 X 2 1 00 CM PA

A

xx .X 0 0 X c ax 0 X

X 0 M 1 in

mXA

A - o u 3 X

O •rH 5 x

X 0 X <c 1 0 ID CD

A

A o o W

XX o X

J 1 IX 00 CD

A

A S —' c (—

0 •rH Oh 3 co

X

X o X Oi 1 in CD COA

A • 0 X

X rH 0 X

O 0 c • rH >1

A

A

C 0 X

X 0 X -X

X

X •rH

X 4H

A

A (—

OX

X 0 UXX

a •rH •tc

A

A rH •rH

X

Xx

x 0 0 •rH 0 >iX x: 1 >—

in 0 A

A 0 4-1

W 0 u cnX

a 0 O

x

X c CJ 1 1—

0 A

A

w 0 (0

X 0 0 *rH

X

XC 0 0 o 1 •3* 3 m

A

A

Q l-i -!->

X

X 1 5 0 X •rH 'C 'C

x 1 p- cn co

A

A o o o c X 0 0 CM 0 •rH CD 1 cn c 3 A A ST *4-1 c _* •rH 0 X X 0 c CO rH =8= X 1 <n 00 1 A A u 03 o X *X X X o o Eh 1 0 o 'T A A CJ a> i—I o rH cn W X 0 •rH X .y 0 X X 1 CM X rH A A CD • £ 0 rH a x •rH X to X 0 u «x a 1 ID o A A 2 o 3 •rH E X o 0 CO X O! o >x T3 Eh ! r~- CD X A A o a; 4-1 •rH X X c x o 0 rH 0 0 X | m ID o A A M Ci3 4-> u x cn X o c O SH CO 0 X C CO o 1 •o X 0 A A E- a: o 0 0 X 1-1 0 •X «rH X X O X 3 3 1 rH o A A < Eh 0 X 3 0 •rH X X 0 X X X w 1 <n 0 CO A A DC rH 4-1 <0 X X X 0 0 0 X X 0 0 w 1 X 3 A A w Q 0 X •rH N X o o 0 X X • Q 1 ^r 0 X A A cm 2 to in 0 l-i 0 X •X Sco >t X X 0 0 CO A A o < •rH X 0 X C rH X rH X A A c X Eh 0 O rH 0 >1 c c c CO CO o K A A Crj CO 0 c a in X *X C rH o 0 •rH jy X 4H X x: 1 ID 0 rH A V o DC 0 o •rH *rH 0 X 5 •X 4J •rH 0 o CO X 0 0 u 1 O ID 0 V V o X 2 u - X o X O 0 X rH o •X 0 T5 T? o i 00 cn cn V V DC s c • X C 0 > •rH a rH X a O X i X o X V V w DC W 0 X ID >. D CM X 0 CO X 0 X X X DQ i T3 X V V Q w 0 l-i X in o X W o co 0 X o 4-4 X X 0 0 i X 0 o V V o x O X 1H s 0 rH a O X CO 0 ai O Eh i CO uo CO V V s IX X •iH *H X a x CO 0 rH X < X 00 <y\ 3 i CO p~ 3 V V X 0 1-1 X 0 X •X 3 X rH TJ CO 0 r- 00 Du i CM o 3 V V CjJ 4-> 01 ? 3 x x X 0 •rH c X X X VD 2 i rH 3 co V V w Eh 0 3 0 rH 0 a x X 0 •iH • 0 m CD M i cc 0 X V V Q 4-1 o 0 X 0 X 0 0 0 X c -X X •sr LO i CO 3 in V V DC w o IH X > o X X X .y X •rH u a CO i in X V V CO (CJ 2 cn .V 0 u 0 o f0 o •rH CM CO CO i 00 0 p~ V V 2 4-1 l-H c X o c x x o X rH rH u i—

CM

w i rX o V

V a,

a l-H

W -H o X -x

C

X rH E X ax o t—

c i u cn. 3 V

V

M >, CJ 1-1 0 a 0 0 X 3 0 V

V CJ

X CO 0 X 1-1 s >1 rH

O 0 C

X tx>

x

X II II

V

V o < X 0 X • X Oh

X rH 3 to c X

X * V

V 0 o x o O 0 a c C 0 •iH 0 i vr 0 rH

V

V 3 ai 0 U o X

a e o •rH rH

X

X i u ID 0 V

V

X i-l 0 b 0 CO 0 o 0 X >1 o ! CO cn cn

V

V a) 4-1 0 X 0 CMX

X >i

X 0 >1 0 0 X 0 X 1 <4-1 o X

V

V

x

X 0 X CO

O -H

X 0 CO r->

X

O 0 T3 o 1 3 rH

V

V 4-1 in

OX

X p>

XXX

X

X

a

X 0 0 Eh % X 0 o V

V •«H o <y\ 0 •x

O 0 u 3 a

x > X I CO in CO

V

V c X

X CD

X 0 X -x

X 0 0 CO •rH

O

w 1 cn p- 3 V

V •cH 4J •rHM o O

X

X EhX rH o 0 c Eh 1 CM o 3 V

V

X

X

M CM to

X >i*x •rH

a T3 IX

U o 1 rH 3 CO

V

V a) 0 1 CJ

X r" jy rH

U T3 E C

X IX •rH •rH oc; 1 CD 0 X

V

V 3 4->

C CO 0 P~ o c 0 0 • 0 0 CO 0 X

XM 1 CO 3 inV

V o 0 < 0 X

O *x

x

a jy 'VX

X

a 0 X. 1 in

X

V

V E c > X CD 1—

0 CO

u c 0 TJ •iH 0 0 Na 1 00 0 p~

V

V •rH 0 X in 0 X

X E o o X lx

XX •rH

M 1 pX o V

V CJ 03 in in c •rH •x

W 1—

a CO •rH 0 rH o 1 u CO 3 V

V DQ rH 0 •rH

r

O

X

X -x

X CO •rH

X 0 o 0 V

V CJ

a 0 rH 5 O

X 0 X

X

X

X

X •rHV

V cn s C

X

X

X

X

XX

XX

ua

Xu 1 V

V 0 0 0 0 VO 0 o a

X

X 0 •rH •rH S 1 •—

CM co

V

V

xx

X

X o 0 X (3

a c 0 o c X c X

X c (-H 1 V

V Eh Eh Eh Eh s X o w 0 M

X o t-H Eh •rH 5 CJ

M Eh 1 V - 29 -
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

DES MODES OF OPERATION

CIPHER TEXT ERRORS AND THE CFB MODE

The 8-bit CFB mode in the decrypt state has been selected.

The plain text is the ASCII code for "Now is the time for."

These seven-bit characters are written in hexadecimal

notation (0 , b7 , b6 , . . .

, bl ) . The cipher text character at

time #4 has been changed to "c4" instead of the correct

value "c3." In the general k-bit CFB mode, bit errors

within a k-bit character will affect the decryption of one

character in those bit positions corresponding to the errors.

Succeeding characters will experience an error probability

of approximately fifty percent until the garbles have been

flushed from the DES input block. In 8-bit CFB, errors

within a character affect the decryption of nine cipher

text characters before cryptographic synchronization is

re-established.

The ® represents bit-by-bit, modulo-2 addition.

Cryptographic Key = Initialization Vector =

TIME DES INPUT BLOCK

= 0 1234 567 89abcdef

= 1234567890abcdef

DES OUTPUT BLOCK C ® 0 = P

1 1234567890a be def 3494ccf2bda243a6 7a © 34 = 4 e 2 34567890abcdef 7a bd914d9 386658541 d2 ® bd = 6f

3 5678 90 abed ef7ad2 adaf8c45c53flf92 da © ad = 77

ERROR IN NEXT CIPHER

4 7890abcdef 7ad2da e3a 3acc8 6c4 29d97 c4 © e3 = 27

5 90abcdef 7ad2dac4 23ae7d3f645f7daa 35 © 23 = 16

6 abcdef7ad2dac4 3 5 aca8467513ba93ae 80 © ac = 2c

7 cdef7ad2dac43580 383b374dc55ba511 8a © 38 = b2

8 ef7ad2dac4 35808a fbebef 188 f 6ceab0 e6 © fb = Id

9 7 ad 2d ac 4 35808a e6 307a55324bc7d098 27 © 30 = 17

10 d2dac435808ae627 a3179850047a27f9 08 © a3 = ab

11 dac435808ae62708 0d0eaf64dc7e5ccb Of © Od = 02

12 c435808ae627080f 5cc2582fc7ca06f

3

6d © 5c = 31

AUTORESYNC ON NEXT CIPHER

13 35808ae627080f 6d 953d f bl 2d8a4cf

4

f c © 95 = 69

14 808ae627080f 6dfc dc365b7e426e726e bl © dc = 6d

15 8ae627080f 6dfcbl 57cb75f 386 e7 6662 32 © 57 = 65

16 e627080f6dfcbl32 68bbd6da0 37c3ebl 48 © 68 = 20

17 27080f6dfcbl3248 71e50a54bd8clf Id 17 © 71 = 66

18 080f 6dfcbl324817 b91c8fd54dld45f

5

d6 © b9 = 6f

19 Of 6dfcbl324817d6 009b705bb2ef 50d6 72 © 00 = 72

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- 30 -
APPENDIX C

CBC AND CFB FLOW CHARTS

(FOR ILLUSTRATIVE PURPOSES ONLY)

- 31 -
FIGURE C.1: CIPHER BLOCK CHAINING (CBC) OPERATIONS

LEGEND:

K= CRYPTOGRAPHIC KEY

IV= INITIALIZATION VECTOR

li= i-TH DES INPUT BLOCK

Oi = i-TH DES OUTPUT BLOCK

Pi = i-TH PLAIN TEXT BLOCK

Ci = i-TH CIPHER TEXT BLOCK

©= EXCLUSIVE-OR

HOUSEKEEPING:

LOAD KEY, K

CHECK PARITY

TEST DEVICE

LOAD IV

i = 0

ENCRYPT

OPERATE DES

ALGORITHM TO

OBTAIN CIPHER Oi=Ci

J1 ' <

i=i+l

1

©

L_

/ INPUT

/ CIPHER TEXT

j L_

OPERATE DES

ALGORITHM TO

GENERATE Oi

DECRYPT

- 32 -
FIGURE C.2: CIPHER FEEDBACK (CFB) OPERATIONS

LEGEND:

K= CRYPTOGRAPHIC KEY

IV= INITIALIZATION VECTOR

li= i-TH DES INPUT BLOCK

Oi= i-TH DES OUTPUT BLOCK

Pi= i-TH PLAIN TEXT CHARACTER

Ci = i-TH CIPHER TEXT CHARACTER

©= EXCLUSIVE-OR

HOUSEKEEPING:

LOAD KEY, K, CHECK PARITY,

TEST DEVICE

LOAD ll = IV, i=0

T

i = i+l

OPERATE DES

ALGORITHM

TO GENERATE Oi

COMPUTE

CIPHER TEXT:

Ci=Pi©Oi

COMPUTE

PLAIN TEXT:

Pi= Ci©Oi

FEED BACK Ci TO

LOW ORDER BITS OF

li REGISTER

FORMING l(i+1)

- 33 -

APPENDIX D

EXAMPLES OF AUTHENTICATION-ONLY MODE

- 35 -
A • • A A dl • A A 3 p rH di A A c O X O X ON A A a) E cn p i—1 A A (1) <L> •rH • O A A X CJ C p CJ • X A A P o < • fC A A w o •rH c/i z • r-- A A rc p P P 3 CD A A X <0 •rH dl d) X A A o o X P II A A X • p •rH c p D r- A A o i/i P o d) X CJ A A cj •rH o dl C X i—I < A A CQ X p c <1> C/1 p d) o z A A cj a) O X o •rH C/l -—- A A N 3 P p 5 A di A A u P 3 dl c c II ON A A 2 <u c C/l rc N On d> 0 i—1 A A X p dl •rH C d) s •rH fa 1 O ON to 1C o A A CO c dl CJ X O X • p CJ 1 co CJ ^ CJ CJ X A A => 3 p w CQ P rH rc o 1 ON r- [- X < (C A A o X •rH CJ •rH CO c/i u P X 1 ON ^ X X z A A w o •rH X 2 ro o O CQ 1 CO in oo 00 o A A Q w P dl 3 X P C 1 r- m CM A A o >. X c/i d) E-t 1 CM 3 O 3 CM A A 2 p X P p P CJ d) i—I

=> 1 O

H CD 3 t"

A

A • tC

p • •rH a< E rc fa 1 O

O P P A

A Z >1 3 c •rH c/i

C

X Z •rH E Eh 1 00 CD 00 di CO

A

A o X <D •rH 5 o •rH

p

p •rH 3 1 X

X ON CD

A

A

M 2 p

X

p

p

u P o O 1 CM rc

m 1—1

CDA

A Eh o u 3 di

Q 3 c •rH d) di 1 in o dl o O

A

A < 1 dlp 0)N

M

O dl

X

x 3 CO 1 3 P o X CM

A

A cc 2 X •rH P z P c 1 p ro

W 1 p o m rc in

A

A

w o dl

X <0 i—1 1 3 CM

X

Q 1 d) •a*

X r" CD

A

A cu

X c/i 1 c i—i

d) >. CO 01 d> 3 A

A o Eh 00 <u tC

X P 3 •rH

X CD

A

A < c pp

X dl to ON

A

A fa

u dl tC C/l •rH P 5 c p <Ti fa 1 ON *3* ON rc co

A

V o X dl ci •rH o c/i rc

O •rH 0) ON CJ 1 ON -s* di

V

V Eh

X c p

O dl 2 3 P O 1 P ON CM r- rV

V fa 2 w o o •rH rH s c O 00X 1 00

X CM

X o V

V

w

w i/i •rH

u

u

r—1 p

Ca d)

X CM OQ 1 CM

O 00 00 CM

V

V

p a: 10 o rc 3 E P p tC

X 1 X CO

xm inV

V o Eh

X a) a) rH 3 3 E rc

O

p CT\ CO E-* 1 coXcr o CD

V

V z 3> P 3 X cr <u E X P •rH 00 o 3> 1 o rc r" CD 00

V

V < <D 3 i—l

<u 3 O dl Vh t—1

fa 1 X o p CD

V

V fa

p

p to

r 3 ci dl S CD o 2 1 Cl rc

x rcV

V

ww tC cj > P cu rc 0) 3 m rc

M 1 rc cdx in rV

V

Q rc

p 3 X

X CL dl •rHO d> co 1 CD in oo -cr o V

V Eh

wp E dlp

X

U

p CO o 1 o rc in

X CMV

VpO P o C/l rc P to CM o CO 1 o X on cd CO

V

V fa

p wi •3

p •rH

X <—1 o fa 1 o x oo CO

V

V o a

C c P p

X 01 o o Q 1 o rc cm 3 ON

V

VN

Q rc •rH -X

X o CJ

p CD

V

V

w

p t-H P <0 o ci dl fa CO <u II IIOV

V

X o z O 1—1 o o P < p CM

V

V fa c 3 CU rH 1—t o 1 o o o rV V z <u <u 3 r X X c • d> (0 p 1 O cm o n- V V < X dl •rH c X p >. o 1 O o m o Eh p V V X dl p C/1 4J p p (0 o p ro dl p 1 O CM CD o X CD V V w x a. c/i 3 X rH •rH X fa o 1 O co 3 o fa d) V V p p a d) a p 01 o d> 1 O r~- cd o E-< ^ V V 2 a 03 •rH c p rC •rH > E-« 1 O ON ON o ON V V < c I—1 P •rH CD C p X 1 o CD CD o ON V V •rH a O c X •rH P •rH c fa 1 o o ^ o p V V E P 0) CO •rH p P X X o o Eh 1 o cm r~ CM • • oo V V <u tC X w rc 01 dl 1 •rH •rH 1 o r- o CM E-* CM V V 3 X 3 p Q i—1 3 di p c X P 2 1 o r- cm r-~ X X V V o <u dl a c 3 d) a rc M 1 o p m p fa CO V V e N p p fC c > rc N < 1 o CD CD CD Eh O V V c/i •rH (0 to p ro •rH dl p •rH X 1 o dl 00 CD i—1 V V cj •rH rH X p U) Q P fO 01 cr> rH fa 1 o CD CD fa CJ V V CQ X <0 p •rH rc M rc 1—1 O (C O ro V V u p •rH p 1—1 z 3 a <u P •rH < CD V V P 0) 01 a P fa 1 fa O V V di p •rH p cu dl dl dl d> 01 >. •rH z 1 X CM CO "3* fa Q O V V x o C o X X X X X X p C M 1 fa X o V V Eh fa •rH 2 p E-« E-t P E-* E-t o M Eh 1 z z <3, V - 36 -
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

DES MODES OF OPERATION

AN EXAMPLE OF THE AUTHENTICATION-ONLY MODE USING 8-BIT CFB

The 8-bit CFB mode in the encrypt state has been selected.

For this example the MID structure consists of a 32-bit

date-time code concatenated with a 32-bit, one-up binary

counter. The date-time code designates the year (0),

day of the year (003), hour of the day (10 or 1000 hours),

and minutes (15). This value is used to uniquely identify

the cryptographic period. The binary counter has been

initialized to 00000001; it is incremented by ”1" for each

message to be authenticated within the same DES key period.

A 24-bit MAC was selected for this example.

The plain text is the ASCII code for "Now is the time for."

These seven-bit characters are written in hexadecimal

notation (0 ,b7 ,b6 , . . . ,bl ) . The © represents bit-by-bit,

modulo-2 addition.

Cryptographic Key = 0123456789abcdef

Initialization Vector = 0003101500000001

IME DES INPUT BLOCK DES OUTPUT BLOCK P © 0 = C

1 0003101500000001 973c7b54e5bdd4da 4e © 97 = d9

2 03101500000001 d9 bde39e43bf3f 2258 6f © bd = d2

3 101500000001 d9d2 1998d46fe4175d64 77 © 19 = 6 e

4 1 500000001 d9d26e 5ddf40f 5124917fa 20 © 5d = 7d

5 00000001 d9d26e7d 09342c9870b4fe85 69 © 09 = 60

6 000001d9d26e7d60 f fedd60c4e72814e 73 © ff = 8 c

7 0001d9d26e7d608c 3f873ff6e2e4cd39 20 © 3f = If

8 01d9d26e7d608clf 724f0467a5f ffdeb * 74 © 72 = 06

9 d9d26e7d608clf06 9ecl876e54493a52 68 © 9e = f 6

10 d26e7d608clf 06f

6

01a5d888c472bcdd 65 © 01 = 64

11 6e7d608clf 06f 664 0b6f90e412246e54 20 © 0b = 2b

12 7d608clf 06f 6642b 992db95a018d921f 74 © 99 = ed

13 608 cl f 06f 664 2bed 95c9b701a4681991 69 © 95 = f c 14 8 cl f 06f 664 2bed f

c

b2e4f 4318882ca59 6d © b2 = df

15 If 06f 6642bedfcdf 6dfff2d406ea81de 65 © 6d = 08

16 06f 6642bedfcdf 08 43148a850bd66dc8 20 © 43 = 63

17 f 6642bedfcdf0863 a26e7ae5815d7b60 66 © a2 = c4

18 642bedf cdf 0863c4 57d8cc8f837534b9 6f © 57 = 38

19 2 bed fcdf086 3c4 38 560cccbc949bb350 72 © 56 = 24

20 edfcdf0863c43824 63113f72e8a09991 = > MAC = 63113f

MESSAGE FORMAT:

MID TEXT MAC

0003101500000001 4e6f77 20697 3 207468652074 696d6 520666f 7 26311 3f

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- 37 -
38
APPENDIX E

RECOMMENDATIONS FOR DES IV MANAGEMENT

- 39 -
The security of a CFB or CBC implementation depends,

inter alia, upon cryptographic synchronization procedures.

For these modes of operation, this means proper management

of the DES initialization vectors (IVs) . IV management encompasses the generation, distribution, protection, usage,

and disposal of initialization vectors.

At least one standard (*) currently under development

is specifying security requirements for CFB and CBC IVs in

telecommunication environments. It is conceivable that a special application standard may need to tailor IV management to fit a particular set of application requirements in

order to make the standard reasonably efficient as well as

effective.

This standard on the modes of operation does not mandate specific techniques in IV management. This standard

specifies only those requirements which are essential for

unambiguously describing the mechanics needed to implement

the modes of operation.

The following suggestions are recommended as preliminary guidelines which may be used until the publication of

official guideline(s) or standard(s) in the area of IV

management

.

CBC IVs : single

period,

sur e

.

pe r iods

(-64) . will

CFB IVs : CFB IVs consist of 64

DES additive stream ciphers,

change as frequently as possibl

additive stream to protect th

not repeat within a specific cr

different cryptographic perio

than 2 to the (-48). As a coro

tain a maximum of sixteen fi

pseudorandom process is suffici

CFB IVs do not need to be pro

they may be transmitted unencr

channel

.

c

.

binary digits. As with other

it is desirable that CFB IVs

e in order to insu re a un i que

e plain text. CFB IVs sho uld

yptographic pe r iod or ac r OSS

ds with a probabil ity g rea ter

llary

,

CFB IVs may only c onxed bits. A 48-bi t ra ndom or

ent to satisfy th i s pr oper ty.

tected from di sclo sure , i • 0 • / ypted through an un secu red

The CBC IV consists of sixty-four binary digits. A

IV may be used throughout an entire CBC cryptographic

however, this IV should be protected from discloCBC IVs should not be repeated across cryptographic

(same key) with a probability greater than 2 to the

A 64-bit random or pseudorandom generation technique

satisfy this char acter i st

i

* Proposed Federal Standard 1027; Telecommunications:

Security Requirements for Use of the Data Encryption

Standard; 4 September 1979, 18 pages.

- 40 -

-NOTES-

-42

8

bl

02-